A cluster of network devices may have each network device configured to establish transport layer connections with clients and servers. Each network device in the cluster may be a multi-core device with each configured to establish transport layer connections. A transport control protocol (TCP) connection may be established responsive to a handshake in which SYN and SYN ACK are exchanged between the end points. A device, such as multi-core device or a node in a cluster, may be subject to a SYN flood attack. A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target device to try to consume enough server resources to make the device unresponsive to legitimate traffic.